Paychex Inc. was cruising in 2002 when it hit a bad-debt pothole. When write-offs more than doubled that year, it was a culture-changing shock. In theory, it was paying the employees of its clients with money it had already collected through the ACH, but the companies could still take money out of their accounts and stick Paychex with the ACH equivalent of a bounced check. And in 2002, when the dot.com bubble burst, that was happening all too often, reports Frank Fiorille, director of enterprise risk management.

That's when management launched the ERM project and hired Fiorille, who had a bank credit background. His assignment: set up a leading-edge program with an emphasis on front-end credit review, drawing largely from the current staff, which included no credit experts. The first line of defense would be a sophisticated effort to screen out companies on the verge of bankruptcy and deliberate fraudsters, but it had to be automated. Paychex, based in Rochester, N.Y., has 540,000 clients for its payroll and human resource services; 99% of its transactions are for less than $100,000, but they account for 75% of its credit exposure. Using an array of credit bureau reports and analysis tools from Experian, Equifax, D&B, Lexis Nexis and law enforcement agencies, the ERM staff automated the way more than 100 field offices could screen those large numbers of transactions and highlight the ones that look suspicious. In extreme cases, clients would be asked to fund their payroll by wire.

It worked. In the first year under ERM, the bad-debt provision was reduced by 72%. And it stayed low, declining slightly over the next two years while overall business and exposure continued to climb. "We created a bank-like credit function with front-end credit review, back-end collections and support from legal and audit," Fiorille says. "In 2002, we were behind, but now we're a leader."